High severity · published Nov 5, 2024
CVE-2024-47254
In 2N Access Commander versions 3.1.1.2 and prior, an Insufficient Verification of Data Authenticity vulnerability could allow an attacker to escalate their privileges and gain…
7.2
CVSS
0.4%
EPSS
No
On KEV
Description
In 2N Access Commander versions 3.1.1.2 and prior, an Insufficient
Verification of Data Authenticity vulnerability could allow an attacker
to escalate their privileges and gain root access to the system.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
2A
2N Access Commander · 2N
<=3.1.1.2 · source: vendor
AC
Access Commander · 2n
through 3.1.1.2 · source: NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-47254
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-47254
www.2n.com
https://www.2n.com/en-GB/download/Access-Commander-Security-Advisory-2024-11
More from 2N Access Commander
8.1
CVE-2024-47258
2N Access Commander version 2.1 and prior is vulnerable in default settings to Man In The Middle attack due to not verifying certificates of 2N edge devices
7.8
CVE-2024-47255
In 2N Access Commander versions 3.1.1.2 and prior, a local attacker can escalate their privileges in the system which could allow for arbitrary code execution with root…
7.2
CVE-2024-47253
In 2N Access Commander versions 3.1.1.2 and prior, a Path Traversal vulnerability could allow an attacker with administrative privileges to write files on the filesystem and…
6.0
CVE-2024-47256
Successful exploitation of this vulnerability could allow an attacker (who needs to have Admin access privileges) to read hardcoded AES passphrase, which may be used for…